Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This might sound weird. My colleague and I were working on a Windows machine. He frequently shuts it down through the LAN.

He usually follows these steps:

  1. Access command prompt, enter shutdown -i.
  2. Choose my IP address, click on Shutdown.
  3. Select a timeout of 2–3 seconds.
  4. Click OK

Unfortunately, I cannot disable remote access to my computer. Is there a way to prevent this?

share|improve this question
142  
Perhaps you could ask him to stop shutting down your computer remotely as well? It's a waste of company time and resources. –  Thomas Feb 15 at 7:42
15  
We made a game of this in Uni trying to remote shutdown each other's PC. We all got very good at going Win+r 'shutdown -a' –  50-3 Feb 15 at 7:43
19  
With great power comes great responsibility. –  Chris Feb 15 at 9:57
19  
You could either ask him to stop, kindly, or less kindly, ask your superior to make him stop, or plug your/his machine off the network. Just, don't break his arms. It's not considered "acceptable retaliation". –  Kheldar Feb 16 at 23:21
22  
It's unfortunate that the highest-voted answer, although confirmed by several mods as being on-topic, is now locked and cannot be upvoted; while the technical solution, which many of us obviously believe to be missing the point, is still open for voting. Just saying. –  alexis Feb 17 at 12:07

8 Answers 8

up vote 188 down vote accepted

You are seeking technical solutions to a social problem and you're trying to address the symptoms instead of the underlying cause. This runs the risk of failure if he finds some other way of shutting down your machine.

Talk to your friend and remind him that you're not pals messing about at university, any more: you're professionals being paid to do a job. His behaviour is completely unacceptable in the workplace. He is deliberately stopping you from doing your job which, ultimately, is putting your job at risk. What happens when your boss calls you in to explain your poor performance? Do you accept the blame and get yourself fired? Or do you blame your friend and get him fired? Friends don't put friends in that situation.

Tell your friend that he needs to stop. Right now. Period. If he doesn't, you're going to have to talk to management.

share|improve this answer
51  
Since there's been some concern about the non-technical nature of this answer: We discussed a similar case a few years ago on the meta site and the consensus is: While questions need to be technical to be on topic, answers don't. They need to answer the question. Which this one does. –  Daniel Beck Feb 15 at 19:23
1  
Stopping one person in this manner may work, but what happens when an anonymous script kiddie happens onto this security hole? –  Nick T Feb 20 at 23:15
1  
@NickT If the vulnerability is accessible from outside then a technical fix on the OP's machine won't help much, either, since every other machine in the company will need the same fix. –  David Richerby Feb 20 at 23:18
2  
This is a really serious answer. Not sure the situation is THAT serious. Who said the OP ever really works. He is on this site complaining for hours. Could have shut his ass down 50 times in the time he spent on SU. I would change his office dictionary file so he spells every common word (look at his old emails) wrong. Also change "thanks" to "thanks for nothing". –  blankip Feb 25 at 7:59
    
+1 for recognising the difference between a technical and a business situation. –  S List Feb 25 at 9:17

From TechNet:

In order to use this feature, the Remote Registry service must be enabled on the remote computer. See Enable the Remote Registry Service for more information.

Access to the Remote Registry or membership in the Administrators group on the remote computer is the minimum required to complete this procedure.

share|improve this answer

The policy you want to change is in

Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment

Locate the policy named "Force shutdown from a remote system." By default, this policy has a value of Administrators. Just edit it to be an empty list, or put your friendly trusted IT person in there instead.

policy to force shutdown remotely


A note about "Shutdown: Allow system to be shut down without having to log on"

This policy applies to local shutdowns only. That is, it controls whether someone present at the computer can shut it down without having to log on first. By default, this policy is Enabled on workstations, and you can see the shutdown button in the lower right corner of the Windows logon screen.

local shutdown allowed

If you set this policy to Disabled, you will no longer see the shutdown button on the logon screen. A user would have to log on to the computer to shut it down. This is typically how servers are setup.

local shutdown prohibited

This policy does nothing to prevent a remote shutdown. You can try it yourself on a system that you can shutdown remotely. Set this policy to Disabled, and you will still be able to shut down that system.


A note about the Remote Registry service

Disabling the Remote Registry service does not prevent remote shutdowns. Remote Registry only affects the ability of the Shutdown Event Tracker to record the reason for the shutdown. If the reason cannot be recorded, the shutdown still occurs.

share|improve this answer
    
Note, however, that if you have administrator access, you can bypass this policy if you really want to. It just makes it a little trickier. The bottom line is that if the bad guy has admin to your machine, you've already lost. –  Harry Johnston Feb 17 at 21:27
    
@HarryJohnston Not disagreeing, but how is that done? I might need to prevent that in the future, if possible. Maybe I shouldn't ask in public. :) –  Patrick S. Feb 17 at 21:28
    
Well, as an example, you could use psexec to run shutdown on the machine locally. The "deny access to this computer from the network" policy should block this class of attack, but may also prevent legitimate access as in the OPs situation. –  Harry Johnston Feb 17 at 23:02
1  
True. I always worry about telling people how to set policies in a corporate environment. Hate to make a fellow IT geek mad. –  Patrick S. Feb 17 at 23:07

You could add the following into a file, say, C:\kill-shutdown.ps1, then put the file into the group policy: Local Computer Policy>Computer Configuration>Windows>Settings>Scripts (Startup/Shutdown)>Shutdown

if ((test-path C:\allow-shutdown.txt) -ne $True) { shutdown -a }

Then, if C:\allow-shutdown.txt doesn't exist, it will abort ALL shutdowns.

share|improve this answer
2  
Probably more efficient than the looping batch file. Sadly needs admin privileges –  Yet Another User Feb 16 at 20:48

This is a simple way to fix this problem without admin privileges.

But still.. Talk to your colleague man. I leave this with the community for any circumstances where disciplinary action is not readily available e.g internet cafe.

Put below code in a new text file. then change .txt extension to .bat

if you do not see the .txt extension go into:

  1. "folder and search options"
  2. uncheck "hide file extensions for known file types".

If win 8.1/8, in the my documents window, click view tab and find the options button.

Shutdown abort CODE, remember to close it when shutting down.

 :start
    cls (clear command prompt window.. Optional)
    @echo Shutting Down Cancel   
    shutdown -a
    TIMEOUT 1
    goto start

The code is not resource intensive for modern computers and won't show up in virus scanners. - caus it's not a virus =D

share|improve this answer
16  
This is a bad "solution". –  Nit Feb 15 at 16:34
4  
Why cls if you have already @echo off? –  Ruslan Feb 15 at 18:01
10  
@MAKZ shutdown -a > NUL is more efficient than shutdown -a with cls –  ABFORCE Feb 15 at 21:04
2  
Well it's here if anyone needs it =P CPU KILLER! =D –  Pathfinder Feb 16 at 7:57
2  
Along with this batch file, you should add a step where it checks for an existing pending shutdown initiated by said user, and initiate a shutdown on his machine with a 0 second wait and using the -f switch! –  ErikE Feb 19 at 1:04

Run gpedit.msc and try disabling the option as shown below. Restart your PC to see if it works:

enter image description here
Click to enlarge

share|improve this answer
18  
The right to shut down without logging on pertains to local console shutdowns. For remote shutdowns, you should go to Local Policies | User Rights Assignment | Force shutdown from a remote system. –  Patrick S. Feb 15 at 15:52
1  
@PatrickS. thanks, but for that security setting determines which users are allowed to shut down , and it's default value is Administrators . Apparantly his colleague is not an Administrator to his PC –  MAKZ Feb 15 at 15:58
10  
+1 Finaly a real answer. Enjoy the "Good answer" badge. –  Tomas Feb 16 at 9:40
2  
@MAKZ I didn't see any mention that his colleague is not an admin. Also, it is the case that the policy you mention pertains to local (console) shutdowns. Read the explanation of the policy. –  Patrick S. Feb 16 at 21:36
3  
If the colleague weren't an admin, he wouldn't be able to shut down the machine remotely (unless the machine is badly misconfigured). The setting you've indicated is completely irrelevant. –  Harry Johnston Feb 17 at 20:16

Remove him from the ipc$ share of your computer:

  • Open Computer Management.
  • If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.
  • In the console tree, click System Tools, click Shared Folders, and then click Shares.
  • In the details pane, right-click the shared folder, and then click Properties.
  • On the Share Permissions tab, set the permissions you want:
  • Add him as user with no rights.
share|improve this answer

You can disable this by either disabling the Remote Registry service or removing all other access to shutdown

Disable Remote Registry:

sc config "RemoteRegistry" start= disabled

Shutdown location:

C:\Windows\System32\shutdown.exe


Warnings:

Removing access to shutdown.exe will result in some unexpected results when doing any system tasks which involve resets ect...

As for Remote Registry:

Disabling the RemoteRegistry service will break most patch management solutions including the Software Update Service and Windows Automated Update. If you disable this service, you will have to perform patch management manually

-Brian Groth's Life at Microsoft

share|improve this answer
1  
Uh ... in this scenario, the other user is running the copy of shutdown.exe on their own machine, not the one on the machine being targeted. So deleting your copy really isn't going to help. –  Harry Johnston Feb 17 at 23:03
    
@HarryJohnston If you remove your colleague's access to shutdown it work –  50-3 Feb 17 at 23:06
    
... and what's supposed to stop them from downloading another copy, or any program with similar functionality? –  Harry Johnston Feb 17 at 23:08
    
What's stopping you from walking over to his desk and flipping the AC/DC switch? there is no way of 100% stopping this behaviour –  50-3 Feb 17 at 23:50
4  
No, but this option seems particularly ineffective to me. And if you consider the big picture, messing with the other guys computer probably isn't a good idea, as it's only going to escalate things, and it makes you look bad if and when management get involved. –  Harry Johnston Feb 18 at 0:01

protected by Community Feb 18 at 12:08

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.